workstation slowly losing disk space

Is anything being stored as a log file on the system that could be growing everyday?

Did you turn off System Restore before running your scans?

How many partitions are on the drive? Anything writing to one of those?

A) Searched for the largest files and then kept an eye on them?

B) Virtual Memory issue? Is the virtual memory eating away at the drive?

C) Running apps? Do you have any apps that have a memory leak?

This is a strange one...I'm curious to know what you find out.

What do you see when you do a search for files when you set "when was it modiefied" to specify dates and then enter the last 1 day.
Before doing this make sure you see all files (advanced options/search hidden files/folders)

If you cloned the drive, something in software is causing the problem.

I would still suspect some sort of worm or virus that is backing things up, replicating itself or using up resources in some way. I have run into a number of instances where some variant of some virus or spyware seems to make it past Symantec/Norton AV, or McAfee -- whatever I have on the system.

I tend to switch between Norton, McAfee and PC-Cillin as a result. Frequently one of these will detect things that made it past the others.

If you can isolate which specific files are getting larger, you can determine where the culprit may be by looking at what apps use those particular files, and basically rule out some sort of software bug that might be triggering a backup even when the app indicates that backup is disabled.

Start by looking at the size of the largest files.

5 GB is an awful lot of storage to disappear overnight, but since this is occurring on a single partition and since this problem still appears after cloning a drive image to a new drive, I would suspect that something is replicating cache files, making things larger or using up storage.

I would blow away both partitions and reformat the entire drive and reload Windows from scratch.

You must be getting to the point where a rebuild will be more cost effective than finding a solution.

I'd be looking at some sort of utility to dump a map of the drive daili and then diff them to see if amything pops up that way.

If that does n't work then you've got to conclude the OS is lying to you in some way. You could go completely paranoid and mount the drive in a linux box and analyse it from there.

I've had a similar issue with a small OBGYN group that has approx 30 nodes and a win2k3 server setup as a small domain. They have no dedicated power and often have surges and brown outs. I've been a broken record about UPS's and their finally moving locations with better power service. My point being is one of the workstations was booting really slowly so I checked it out expecting to find a virus or some spyware. Alas, nothing. What i did find was an empty system32 folder. That's right, it booted with an empty sys32 folder. Later on after a diskchk I looked in again and sure enough more and more of the HDD's files were being gobbled up by some invisible villan. I don't get it either, but now the Windows folder is missing and it still tries ot boot. Unbelievable, I get to a log in screen (no network boot either just in case it crossed your mind) and then it reboots. I've since reinstalled everything and I'm keeping a close eye on it. Thank god they do backups. Curious, what kind of drive is it? Is it attached to a UPS? Is the uPS good? Does it save log files? Have you checked them? That's what I'd do.

You seem to have taken all the obvious & sensible steps already, and I would not pretend to have a ready solution, but have you considered:
1: Power corruption?
2: Check volume stats, switch PC off overnight, then after booting in morning check again
3: Do you have drive compression enabled?
4: Have you checked the trend with a 3rd party utility that is not part of the OS?
5: Switch the hard drive to another identical PC (if available) and then check again
6: Is BIOS latest version?
7: Have a look at utilisation with Task Manager; try uninstalling any app which seems to be hogging resources
8: Try fixing virtual memory rather than let Windows do it
9: Disable hibernation
10: Have you done a file search with size the main criteria (say greater than 1Mb) to see if there are any "rogue" files growing & hogging space. If so, delete it (them), defreag, reboot and check again ...

How big is the hard Drive (total) it could make a difference. Is anyone useing this machine over the night? I think jmgarvin is closer to problem with the virtual memory. You might have to set that yourself manualy (as in a limit set) Also, just wondering, how is the printer set up? With Spooling? Check C:\Windows\system32\spool it should be empty unless you have docs waiting to be printed. Also, do you have any web sites set to your offline web?site? (even internal) Are they set to refresh? E-mails waiting to be sent? (even ones you might not know about, even legit, as news-letters)? And somebody (sorry I forgot who) sugested the logs. There are more than one in more than one place, and most anti-virus programs also keep a log, and it's seperate from the OS log, (on purpose) you have to access that one from the anti-virus program. (is there any scans going on at night?) But I think I would first check your e-mail program, just to see if it's generating e-mail that backing up waiting to be sent (think bot here!)

I appreciate all of you taking time to offer suggestions.
I have a fixed size page file. This machine loses space either plugged in to the network or unplugged. I have searched for files modified and have come up empty. No one touches this machine at night. When the machine starts to lose space, I can either power off/on or reboot and the space returns. I have ran 4 different full virus scans on the PC to no avail. I have ran 3 different Spyware scans to no avail. Yes, it would be easy to backup/format/reload, but then I would never know what was the root cause of the problem...

No one has mentioned the possibility of a rootkit writing the drive. A rootkit can write a file that will not show up on a regular windows search. You can check for this by going to http://www.sysinternals.com/Utilities/RootkitRevealer.html

1. Try installing other flavour of Windows...
2. If prob still presists try installing Linux (any free version available and check this is happening bcos of Windows Virus/worms)

I would hit out on option 2 as this seems to me like a worm has infected.

Have you checked the Recycle Bin? If you've deleted anything that ended up in there it hasn't really been deleted (until you go in there and Remove what's there).

The only reason I thought of this is years ago I worked on an NT 4 box that had a Norton Undelete service running. Basically it did the same thing as Recycle Bin. Anytime I deleted file(s), it hid the file (looked like it was deleted), but kept it in a repository. Over time I lost more and more disk space. For a long time I didn't realize this service was running. I just noticed my free space going down, down, down. I happened upon the service by accident, figured out how to configure it to "off", and that freed up tons of disk space. Anyway, got anything like that running?

I am on a slooow speed dial up so I have NOT checked all the other posts, so sorry if I am repeating anything.

Things that automatically take up space without you knowing about are, and many will clear with a reboot:

1. Temporary Internet files - these do not always show as modified files as they were CREATED and not modified.

2. Prefetch files are also CREATED not modified.

3. Some ecreen savers use their own temporary directory and again CREATE files whilst they are running. In the days of Win 9x and NT a program called After DArk was notorious for eating up space.

4. Some installations of XP have network and system files that just keep growing as they keep live log files while running.

5. Many browsers also grow in space used while open.

One thing that you can do to help track this down is to open the Windows Task Manager and set it to show the columns Memory Usage, Peak Memory Usage, and VM Size. Leave this open and check it every now and then and you can see what is regularly growing.

I have seen this happen before, on two occasions.
1/ In early 90s a program was available I think it was called hyde.
If you ehanged it to ext2bin, a little used DOs program, it hid all the "illegal" software from DOs and Win 3.1. The HD jusr appaered tro be smaller.
If you had a copy of HDIR.com a non approved program, it found the hidden files they had a delta character before them. You could only use 7.3 names. It worked very like MTOOLS in Linux.
2/ Later in the late 90s a person had a twin disk Dell tower with Syquest removable HD, which he locked in a safe. A sort of keyboard sniffer was installed on the first HD and this had copies of all his work and passwords in hidden partitions on it.
It was an early form of command line Linux, and as far as I know worked for several years. All it needed was to boot from a Linux boot disk, stick in an identical Syquest Removable HD, it was a huge 500 meg, and copy the files to it.
I remember that the person who told me about this system had at first thought that the system was unbreakable as PGP was used as well as removing the HD into a very expensive safe with Intrusion Alarms. Of course all the PGP keys were compromised.
If you are doing work that might interest others, this could well be your problem. Or it could be genuine bad sectors. These are either a sign that you HD is on its way out, or that a modern version of "HYDE" is involved.
Your staff could be using it to play games too.
Hyde spread to a local fiem who used it to hide DOOM (the game) and this was played on their network.
Try booting from a Knoppix CD and find just what is on your HD.
Linux will find anything that is hidden there.
If you have a copy of Partition Magic, the bootable CD, you could also look for hidden partitions, and if you had Norton's Utils this would find it.
I suspect that it would be invisable to everything that comes with Win XP, if not, its a useless piece of software.

I'm new to this site, so be kind.
The new HD has the old OS on it.
I would do a clean install.
If the other partitions are not vital on your new HD, you could partition and format the disk.
If this sounds stupid, well...
I've done refurbishing on older inoperable computers.
There is always a solution.
Please let me know how you solve this.
Maude

Have read briefly through all the posts but i have not seen anyone mention safe mode. Unless i missed it.

Have you tried Booting up in safe mode without networking and leave it over night?

If it solves the issue i would suspect it is a worm/virus....

Anyways its worth a shot.

Have you ever run BootVis? If so (and evin if BootVis is removed) the counters may be still on. To remove the counters check the web for the regedit.

Use windows search facility to search your entire hard drive for files modified/created in the last day and then switch to a detail view in the results window and sort by date descending. You should be able to identify the most recently created/modified files and their sizes. Ensure that you are also searching hidden and system files.

This way it should be obvious which files are being added or growing continuously.

Hi,

I want to know what all applications are installed on your machine, cause i have faced such problems due to application malfunction which created huge size file . So if you mention the thirdparty applications installed on your machine

Hi, I haven't had time to read all the posts so maybe someone has suggested this.
Windows allocates disk space as virtual memory and the amount it grabs is at the whim of the magement system unless you have manually set boundaries of min and max space.
Right click My computer, then click properties, Advanced, performance - settings, advanced.

The man says he has found the problem - and a solution - and still the replies keep coming: 2-3 days later !!

The problem was in fact the c:\windows\softwaredistribution folder. For whatever reason it had become bloated and/or corrupted. By stopping and starting the Automatic Update service, renaming the old folder, and restarting the service (the folder gets recreated automatically). Once that was done and I verified that the new folder was in fact recreated and working properly, I removed the old folder. I appreaciate all of your posts to this topic.

www.jam-software.com

I use it all the time for administering our systems. You can probably solve this problem with the eval copy.

They have a nice licensing scheme -- one license can be used either a) by one user on multiple computers (good for a tech), or b) by multiple users on one computer (good for a shared server).

Run Tree Size (http://www.jam-software.com/freeware/index.shtml) and see how large each folder is. Then, every couple of hours, re-run Tree Size to see which folder is growing. This will help you track which folder is growing.

in past a problem related with McAfee antivirus,
caused a problem like that one at work
( a file in c:\WINNT\Temp\???\.. is increasing until it uses all available space )
the name of the file was known to me, and as far as I can guess was choosen when I used the BestFTP explorer, but not sure.. )
The problem disapeared with newer version of viruscan was installed (problably a reinstalation was enough).
( with 'ePolicy Orchestrator Agent' and 'Net Op Host' running in background, and software is updated by nightly SMS updates)

Are you using Trend Micro as your antivirus solution?

You may have a built in backup or image program that images your drive after hours as no limit is put on the number of images can be stored. Set your viw to see hidden files

Interestingly, just last week I got delivery of a DELL XPS 1530 with 500gb (429gb actual size)windows Vista Home Pemium, and from day one my hard drive space has been decreasing by the hour. Did not install or downloaded anything but within a week I lost 27gb!!! Thats driving me crazy!!! I tried to contact DELL support and they said they had never heard of that before (which was strange becouse I see many cases on the subject in website forums), so they passed me to the software department which wanted to charge me 57 sterling pounds to fix the problem!!! Is that a daylight robbery or what? Whats going on here???